Skip to content

3.4.0

Latest
Latest

Choose a tag to compare

View all tags
@marcelmtz marcelmtz released this 11 Aug 20:54
· 0 commits to main since this release
3.4.0
d16a138

Released: 2026-08-11
Upstream: Magento Open Source 2.4.9

Mage-OS 3.4.0 is a security release. It ports Adobe's isolated security patch 249-2026-08-001-CE (APSB26-92), and includes one fix for a crash on the admin new-product page.

All users running Mage-OS 3.x should upgrade promptly. Adobe rates the most severe issue in this bulletin as critical (CVSS 9.1).

composer require mage-os/product-community-edition 3.4.0 --no-update
composer update

There are no dependency additions, removals or constraint changes in this release, and no changes to magento2-base or project-community-edition beyond version bumps. The upgrade from 3.3.0 is low-friction — but read Upgrade notes first, because the media gallery fix is a deliberate behavior change.

For the announcement write-up, see Mage-OS 3.4.0 – Security Release on mage-os.org.

Security

Adobe ships these fixes as vendor/-level isolated patches rather than as a tagged Magento release, so there is no new upstream version — 3.4.0 tracks Magento Open Source 2.4.9, the same as 3.3.0. Mage-OS has mapped the patch onto the source tree so users get it through a normal Composer upgrade.

See APSB26-92 for the full issue list, CVE identifiers, severity ratings and CVSS vectors.

What changed in Mage-OS:

  • Media gallery operations in the WYSIWYG image browser now honor granular ACLs. Controllers under Magento\Cms\Controller\Adminhtml\Wysiwyg\Images\* all inherited Magento_Cms::media_gallery, so the fine-grained upload / insert / delete / create-folder / delete-folder permissions — which already existed and were already enforced in the newer media gallery UI — were ignored by the legacy image browser. Each controller now declares its matching Magento_MediaGalleryUiApi:: resource, and Magento_Cms sequences Magento_MediaGalleryUiApi so those resources register first.
  • Admin review save no longer accepts review_id from request data. Magento\Review\Controller\Adminhtml\Product\Save passed the raw POST body into Review::addData(), so a crafted review_id could reassign the identity of the review that had just been loaded and validated. review_id is now unset before addData().
  • Customer account edit no longer repopulates unfiltered session data. Magento\Customer\Controller\Account\Edit rebuilt the customer data object from session form data without filtering it against the form definition, allowing attributes outside customer_account_edit — including a foreign entity id — into the rendered form. Data is now intersected with the form's declared attributes and the customer id is forced back to the session customer.

The underscore.js update covered by the bulletin already shipped in Mage-OS 3.3.0 and requires no action here.

The affected code is in core packages that Mage-OS 3.0.0 through 3.3.0 pin at exact versions, so there is no practical per-package workaround. Upgrading is the fix.

Fixes

  • Admin new-product page no longer throws a TypeError when the type parameter is missing or is not a string. Magento\Catalog\Controller\Adminhtml\Product\NewAction now null-checks and type-checks the parameter before passing it to the regex validator. (#318 — Michiel Gerritsen)

Bundled add-on updates

None. Every bundled add-on carries the same version as in 3.3.0 — module-page-builder-template-import-export 1.9.0, module-admin-activity-log 2.0.2, module-rma 2.4.1, swissup/module-ignition 1.3.2, module-automatic-translation 2.2.1, module-meta-robots-tag 1.2.1, module-theme-optimization 2.3.0, theme-adminhtml-m137 1.3.4, module-page-builder-widget 1.5.0 and module-inventory-reservations-grid 1.0.5 are all unchanged.

Upgrade notes

Mage-OS 3.4.0 tracks the same upstream release as 3.3.0 (Magento Open Source 2.4.9). No dependencies were added, removed or re-constrained, and extra.magento_version is unchanged.

The media gallery ACL fix changes admin behavior, and some administrators will lose capabilities they currently have. This is the fix working as intended, not a regression, but it will look like one if you are not expecting it.

After upgrading, any admin role that has Content > Media Gallery but does not have the individual Upload assets, Insert assets, Delete assets, Create folder or Delete folder resources will find those operations denied in the WYSIWYG image browser. Before upgrading, review your admin roles and grant the granular resources explicitly to any role that legitimately needs them. The resources already exist in 3.3.0 and earlier — they were simply not enforced by this part of the admin — so you can prepare the role configuration ahead of the upgrade.

Customer account edit form repopulation is stricter. If your store adds customer attributes that are rendered on the account edit page but are not declared on the customer_account_edit form, those values will no longer survive a failed validation round-trip. Attributes correctly declared on the form are unaffected.

Magento_Cms now depends on Magento_MediaGalleryUiApi. mage-os/module-cms gained a mage-os/module-media-gallery-ui-api requirement, and etc/module.xml gained a matching sequence entry. Both modules are part of the standard distribution, so no action is required for normal installations. Custom distributions that strip Magento_MediaGalleryUiApi will need to keep it. This introduces no dependency cycle — Magento_MediaGalleryUiApi only suggests magento/module-cms.

Contributors

Thanks to everyone who contributed to this release:

Michiel Gerritsen, Ryan Hoerr, Marcel Martinez

Upstream credit to Adobe for the security patch this release ports.

Assets 2
Loading